@codemem/server 0.22.0-alpha.5 → 0.22.1

package/dist/index.js

@@ -1,13 +1,14 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, applyReplicationOps, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorReviewJoinRequestAction, coordinatorStatusSnapshot, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSyncResetState, listCoordinatorJoinRequests, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, resolveDbPath, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorReviewJoinRequestAction, coordinatorStatusSnapshot, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSyncResetState, listCoordinatorJoinRequests, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
+import { RateLimiter } from "limiter";
 import { homedir } from "node:os";
 import { count, desc, eq, inArray, isNotNull, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import net from "node:net";
 //#region src/middleware.ts
 var LOOPBACK_HOSTS = new Set([
@@ -113,6 +114,49 @@ function preflightHandler() {
 	});
 }
 //#endregion
+//#region src/request-rate-limit.ts
+function createInMemoryRequestRateLimiter(windowMs = 6e4) {
+	const safeWindowMs = Math.max(1e3, Math.trunc(windowMs));
+	const buckets = /* @__PURE__ */ new Map();
+	let checks = 0;
+	function estimatedRetryAfterS(limit) {
+		return Math.max(1, Math.ceil(safeWindowMs / Math.max(1, limit) / 1e3));
+	}
+	function cleanupExpiredBuckets(currentNow) {
+		if (buckets.size < 64 || checks % 64 !== 0) return;
+		const staleBefore = currentNow - safeWindowMs * 10;
+		for (const [key, bucket] of buckets) if (bucket.lastUsedAt < staleBefore) buckets.delete(key);
+	}
+	return { check(key, limit) {
+		checks += 1;
+		const currentNow = Date.now();
+		cleanupExpiredBuckets(currentNow);
+		const safeLimit = Math.max(1, Math.trunc(limit));
+		const bucketKey = `${safeLimit}:${key}`;
+		let bucket = buckets.get(bucketKey);
+		if (!bucket) {
+			bucket = {
+				limiter: new RateLimiter({
+					tokensPerInterval: safeLimit,
+					interval: safeWindowMs,
+					fireImmediately: true
+				}),
+				lastUsedAt: currentNow
+			};
+			buckets.set(bucketKey, bucket);
+		}
+		bucket.lastUsedAt = currentNow;
+		if (bucket.limiter.tryRemoveTokens(1)) return {
+			allowed: true,
+			retryAfterS: 0
+		};
+		return {
+			allowed: false,
+			retryAfterS: estimatedRetryAfterS(safeLimit)
+		};
+	} };
+}
+//#endregion
 //#region src/routes/config.ts
 /**
 * Config routes — GET /api/config, POST /api/config.
@@ -120,6 +164,7 @@ function preflightHandler() {
 * Ports the user-facing config read/write path from Python's
 * codemem/viewer_routes/config.py, scoped to the TS runtime's current needs.
 */
+var REDACTED_VALUE = "[redacted]";
 var RUNTIMES = new Set(["api_http", "claude_sidecar"]);
 var AUTH_SOURCES = new Set([
 	"auto",
@@ -129,6 +174,20 @@ var AUTH_SOURCES = new Set([
 	"none"
 ]);
 var HOT_RELOAD_KEYS = new Set(["raw_events_sweeper_interval_s"]);
+var PROTECTED_WRITE_KEYS = new Set([
+	"claude_command",
+	"observer_base_url",
+	"observer_auth_file",
+	"observer_auth_command",
+	"observer_headers",
+	"sync_coordinator_url"
+]);
+var SECRET_CONFIG_KEYS = new Set([
+	"observer_auth_file",
+	"observer_auth_command",
+	"observer_headers",
+	"sync_coordinator_admin_secret"
+]);
 var ALLOWED_KEYS = [
 	"claude_command",
 	"observer_base_url",
@@ -216,6 +275,43 @@ function getEffectiveConfig(configData) {
 	}
 	return effective;
 }
+function redactConfigValue(key, value) {
+	if (value == null || !SECRET_CONFIG_KEYS.has(key)) return value;
+	if (Array.isArray(value)) return value.length > 0 ? REDACTED_VALUE : [];
+	if (typeof value === "object") return Object.keys(value).length > 0 ? REDACTED_VALUE : {};
+	if (typeof value === "string") return value.trim() ? REDACTED_VALUE : "";
+	return REDACTED_VALUE;
+}
+function sanitizeConfigForResponse(configData) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(configData)) sanitized[key] = redactConfigValue(key, value);
+	return sanitized;
+}
+function configValuesEqual(left, right) {
+	if (Object.is(left, right)) return true;
+	if (left == null || right == null) return left == null && right == null;
+	if (typeof left === "object" || typeof right === "object") return JSON.stringify(left) === JSON.stringify(right);
+	return false;
+}
+function partitionViewerUpdates(updates, beforeConfig) {
+	const allowedUpdates = {};
+	for (const [key, value] of Object.entries(updates)) {
+		if (!PROTECTED_WRITE_KEYS.has(key)) {
+			allowedUpdates[key] = value;
+			continue;
+		}
+		if (SECRET_CONFIG_KEYS.has(key) && value === REDACTED_VALUE) continue;
+		if (configValuesEqual(value, beforeConfig[key])) continue;
+		return {
+			allowedUpdates: {},
+			error: `${key} cannot be changed from the viewer API; edit the config file or environment instead`
+		};
+	}
+	return {
+		allowedUpdates,
+		error: null
+	};
+}
 function parsePositiveInt(value, allowZero = false) {
 	if (typeof value === "boolean") return null;
 	const parsed = typeof value === "number" ? value : typeof value === "string" && /^-?\d+$/.test(value.trim()) ? Number(value.trim()) : NaN;
@@ -322,12 +418,14 @@ function configRoutes(opts = {}) {
 	app.get("/api/config", (c) => {
 		const configPath = getConfigPath();
 		const configData = readConfigFile(configPath);
+		const effective = getEffectiveConfig(configData);
 		return c.json({
 			path: configPath,
-			config: configData,
+			config: sanitizeConfigForResponse(configData),
 			defaults: DEFAULTS,
-			effective: getEffectiveConfig(configData),
+			effective: sanitizeConfigForResponse(effective),
 			env_overrides: getCodememEnvOverrides(),
+			protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
 			providers: loadProviderOptions()
 		});
 	});
@@ -343,13 +441,15 @@ function configRoutes(opts = {}) {
 		const updates = "config" in payload && payload.config != null && typeof payload.config === "object" && !Array.isArray(payload.config) ? payload.config : payload;
 		const configPath = getCodememConfigPath();
 		const beforeConfig = readCodememConfigFile();
+		const { allowedUpdates, error: protectedKeyError } = partitionViewerUpdates(updates, beforeConfig);
+		if (protectedKeyError) return c.json({ error: protectedKeyError }, 403);
 		const beforeEffective = getEffectiveConfig(beforeConfig);
 		const nextConfig = { ...beforeConfig };
 		const providers = new Set(loadProviderOptions());
-		const touchedKeys = ALLOWED_KEYS.filter((key) => key in updates);
+		const touchedKeys = ALLOWED_KEYS.filter((key) => key in allowedUpdates);
 		for (const key of ALLOWED_KEYS) {
-			if (!(key in updates)) continue;
-			const error = validateAndApplyUpdate(nextConfig, key, updates[key], providers);
+			if (!(key in allowedUpdates)) continue;
+			const error = validateAndApplyUpdate(nextConfig, key, allowedUpdates[key], providers);
 			if (error) return c.json({ error }, 400);
 		}
 		let savedPath;
@@ -371,8 +471,9 @@ function configRoutes(opts = {}) {
 		const restartRequiredKeys = effectiveChangedKeys.filter((key) => !HOT_RELOAD_KEYS.has(key) && !(key in envOverrides));
 		return c.json({
 			path: savedPath,
-			config: nextConfig,
-			effective: afterEffective,
+			config: sanitizeConfigForResponse(nextConfig),
+			effective: sanitizeConfigForResponse(afterEffective),
+			protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
 			effects: {
 				saved_keys: savedChangedKeys,
 				effective_keys: effectiveChangedKeys,
@@ -1079,6 +1180,11 @@ function rawEventsRoutes(getStore, sweeper) {
 //#endregion
 //#region src/routes/stats.ts
 /**
+* Stats routes — GET /api/stats, GET /api/usage.
+*
+* Ports Python's viewer_routes/stats.py.
+*/
+/**
 * Create stats routes. The store factory is called per-request to get a
 * fresh connection (matching the Python viewer pattern).
 */
@@ -1099,6 +1205,9 @@ function statsRoutes(getStore) {
 			viewer_pid: process.pid
 		});
 	});
+	app.get("/api/runtime", (c) => {
+		return c.json({ version: VERSION$1 });
+	});
 	app.get("/api/usage", (c) => {
 		const store = getStore();
 		{
@@ -1177,12 +1286,39 @@ function statsRoutes(getStore) {
 */
 var SYNC_STALE_AFTER_SECONDS = 600;
 var SYNC_PROTOCOL_VERSION = "2";
+var LEGACY_SYNC_ACTOR_DISPLAY_NAME = "Legacy synced peer";
+var LEGACY_SHARED_WORKSPACE_ID = "shared:legacy";
 function intEnvOr(name, fallback) {
 	const value = Number.parseInt(process.env[name] ?? "", 10);
 	return Number.isFinite(value) ? value : fallback;
 }
 var MAX_SYNC_BODY_BYTES = intEnvOr("CODEMEM_SYNC_MAX_BODY_BYTES", 1048576);
 var MAX_SYNC_OPS = intEnvOr("CODEMEM_SYNC_MAX_OPS", 2e3);
+async function readBoundedRequestBytes(request, maxBytes) {
+	const contentLength = Number.parseInt(request.headers.get("content-length") ?? "", 10);
+	if (Number.isFinite(contentLength) && contentLength > maxBytes) return null;
+	const stream = request.body;
+	if (!stream) return Buffer.alloc(0);
+	const reader = stream.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel();
+				return null;
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)));
+}
 var PAIRING_FILTER_HINT = "Run this on another device with codemem sync pair --accept '<payload>'. On the accepting device, --include/--exclude control both what it sends and what it accepts from that peer.";
 function pathWithQuery(url) {
 	const parsed = new URL(url);
@@ -1295,6 +1431,67 @@ function readPeerProjectFilters(store, peerDeviceId) {
 		exclude: parseJsonList(row.projects_exclude_json)
 	};
 }
+function currentProjectScope(row, effective) {
+	return {
+		include: safeJsonList(row.projects_include_json),
+		exclude: safeJsonList(row.projects_exclude_json),
+		effective_include: effective?.include ?? safeJsonList(row.projects_include_json),
+		effective_exclude: effective?.exclude ?? safeJsonList(row.projects_exclude_json),
+		inherits_global: row.projects_include_json == null && row.projects_exclude_json == null
+	};
+}
+function ensureLocalActorRecord(store) {
+	const d = drizzle(store.db, { schema });
+	if (d.select({ actor_id: schema.actors.actor_id }).from(schema.actors).where(eq(schema.actors.actor_id, store.actorId)).get()) return;
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	d.insert(schema.actors).values({
+		actor_id: store.actorId,
+		display_name: store.actorDisplayName,
+		is_local: 1,
+		status: "active",
+		merged_into_actor_id: null,
+		created_at: now,
+		updated_at: now
+	}).run();
+}
+function findPeerDeviceIdForAddress(store, address) {
+	const rows = store.db.prepare("SELECT peer_device_id, addresses_json FROM sync_peers").all();
+	for (const row of rows) if (safeJsonList(row.addresses_json).includes(address)) return String(row.peer_device_id ?? "").trim() || null;
+	return null;
+}
+function claimLegacyDeviceAsSelf(store, originDeviceId) {
+	const deviceId = String(originDeviceId || "").trim();
+	if (!deviceId || deviceId === "unknown" || deviceId === store.deviceId) return 0;
+	const personalWorkspaceId = `personal:${store.actorId}`;
+	const result = store.db.prepare(`UPDATE memory_items
+			 SET actor_id = ?,
+			     actor_display_name = ?,
+			     visibility = 'private',
+			     workspace_id = ?,
+			     workspace_kind = 'personal',
+			     trust_state = 'trusted'
+			 WHERE origin_device_id = ?
+			   AND origin_device_id NOT IN (
+			         SELECT peer_device_id FROM sync_peers WHERE peer_device_id IS NOT NULL
+			   )
+			   AND (
+			         (
+			             actor_id IS NULL
+			          OR TRIM(actor_id) = ''
+			          OR actor_id LIKE 'legacy-sync:%'
+			          OR actor_id = ?
+			         )
+			     AND (
+			             actor_id IS NULL
+			          OR TRIM(actor_id) = ''
+			          OR actor_id LIKE 'legacy-sync:%'
+			          OR actor_display_name = ?
+			          OR workspace_id = ?
+			          OR trust_state = 'legacy_unknown'
+			         )
+			     )`).run(store.actorId, store.actorDisplayName, personalWorkspaceId, deviceId, store.actorId, LEGACY_SYNC_ACTOR_DISPLAY_NAME, LEGACY_SHARED_WORKSPACE_ID);
+	return Number(result.changes ?? 0);
+}
 function peerClaimedLocalActor(store, peerDeviceId) {
 	const row = store.db.prepare("SELECT claimed_local_actor FROM sync_peers WHERE peer_device_id = ? LIMIT 1").get(peerDeviceId);
 	return Boolean(row?.claimed_local_actor);
@@ -1321,6 +1518,10 @@ function redactCoordinatorStatus(coordinator, showDiag) {
 			last_seen_at: record.last_seen_at ?? null,
 			expires_at: record.expires_at ?? null,
 			stale: Boolean(record.stale),
+			needs_local_approval: Boolean(record.needs_local_approval),
+			waiting_for_peer_approval: Boolean(record.waiting_for_peer_approval),
+			incoming_reciprocal_request_id: record.incoming_reciprocal_request_id ?? null,
+			outgoing_reciprocal_request_id: record.outgoing_reciprocal_request_id ?? null,
 			fingerprint: null,
 			addresses: []
 		};
@@ -1346,37 +1547,58 @@ async function acceptDiscoveredPeer(store, input) {
 		detail: "That discovered device is no longer available. Refresh sync status and try again."
 	};
 	const nextFingerprint = String(match.fingerprint ?? "").trim();
+	const nextPublicKey = String(match.public_key ?? "").trim();
 	const nextName = String(match.display_name ?? "").trim() || null;
 	const nextAddresses = Array.isArray(match.addresses) ? match.addresses.filter((value) => typeof value === "string") : [];
+	if (!nextPublicKey) return {
+		ok: false,
+		status: 409,
+		error: "discovered_peer_missing_public_key",
+		detail: "This discovered device is missing its coordinator public key. Refresh sync status and try again."
+	};
+	const groupIds = Array.isArray(match.groups) ? match.groups.map((value) => String(value ?? "").trim()).filter(Boolean) : [];
+	if (groupIds.length !== 1) return {
+		ok: false,
+		status: 409,
+		error: "ambiguous_coordinator_group",
+		detail: groupIds.length > 1 ? "This device is visible through multiple coordinator groups. Review the team setup before approving it here." : "This device is missing coordinator group context. Refresh sync status and try again."
+	};
+	const groupId = groupIds[0];
 	const d = drizzle(store.db, { schema });
+	const existing = d.select({
+		peer_device_id: schema.syncPeers.peer_device_id,
+		pinned_fingerprint: schema.syncPeers.pinned_fingerprint,
+		public_key: schema.syncPeers.public_key,
+		addresses_json: schema.syncPeers.addresses_json
+	}).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, input.peerDeviceId)).get();
+	const existingFingerprint = String(existing?.pinned_fingerprint ?? "").trim();
+	if (existing && existingFingerprint && existingFingerprint !== nextFingerprint) return {
+		ok: false,
+		status: 409,
+		error: "peer_conflict",
+		detail: "An existing peer with this device id is pinned to a different fingerprint. Remove or repair the old peer before accepting this discovered device."
+	};
+	const existingAddresses = (() => {
+		try {
+			const raw = JSON.parse(String(existing?.addresses_json ?? "[]"));
+			return Array.isArray(raw) ? raw.filter((value) => typeof value === "string") : [];
+		} catch {
+			return [];
+		}
+	})();
+	const addressesJson = JSON.stringify(mergeAddresses(existingAddresses, nextAddresses));
+	await createCoordinatorReciprocalApproval(store, config, {
+		groupId,
+		requestedDeviceId: input.peerDeviceId
+	});
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	return store.db.transaction(() => {
-		const existing = d.select({
-			peer_device_id: schema.syncPeers.peer_device_id,
-			pinned_fingerprint: schema.syncPeers.pinned_fingerprint,
-			addresses_json: schema.syncPeers.addresses_json
-		}).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, input.peerDeviceId)).get();
-		const existingFingerprint = String(existing?.pinned_fingerprint ?? "").trim();
-		if (existing && existingFingerprint && existingFingerprint !== nextFingerprint) return {
-			ok: false,
-			status: 409,
-			error: "peer_conflict",
-			detail: "An existing peer with this device id is pinned to a different fingerprint. Remove or repair the old peer before accepting this discovered device."
-		};
-		const existingAddresses = (() => {
-			try {
-				const raw = JSON.parse(String(existing?.addresses_json ?? "[]"));
-				return Array.isArray(raw) ? raw.filter((value) => typeof value === "string") : [];
-			} catch {
-				return [];
-			}
-		})();
-		const addressesJson = JSON.stringify(mergeAddresses(existingAddresses, nextAddresses));
 		if (!existing) {
 			d.insert(schema.syncPeers).values({
 				peer_device_id: input.peerDeviceId,
 				name: nextName,
 				pinned_fingerprint: nextFingerprint || null,
+				public_key: nextPublicKey,
 				addresses_json: addressesJson,
 				created_at: now,
 				last_seen_at: now
@@ -1392,6 +1614,7 @@ async function acceptDiscoveredPeer(store, input) {
 		d.update(schema.syncPeers).set({
 			name: nextName,
 			pinned_fingerprint: nextFingerprint || existing.pinned_fingerprint || null,
+			public_key: nextPublicKey || existing.public_key || null,
 			addresses_json: addressesJson,
 			last_seen_at: now
 		}).where(eq(schema.syncPeers.peer_device_id, input.peerDeviceId)).run();
@@ -1459,7 +1682,7 @@ function filterOpsForPeer(store, peerDeviceId, ops) {
 * When showDiag is false, sensitive fields (fingerprint, last_error, addresses)
 * are redacted.
 */
-function mapPeerRow(row, showDiag) {
+function mapPeerRow(store, row, showDiag) {
 	return {
 		peer_device_id: row.peer_device_id,
 		name: row.name,
@@ -1473,13 +1696,7 @@ function mapPeerRow(row, showDiag) {
 		claimed_local_actor: Boolean(row.claimed_local_actor),
 		actor_id: row.actor_id ?? null,
 		actor_display_name: row.actor_display_name ?? null,
-		project_scope: {
-			include: safeJsonList(row.projects_include_json),
-			exclude: safeJsonList(row.projects_exclude_json),
-			effective_include: safeJsonList(row.projects_include_json),
-			effective_exclude: safeJsonList(row.projects_exclude_json),
-			inherits_global: row.projects_include_json == null && row.projects_exclude_json == null
-		}
+		project_scope: { ...currentProjectScope(row, readPeerProjectFilters(store, String(row.peer_device_id ?? ""))) }
 	};
 }
 function isRecentIso(value, windowS = SYNC_STALE_AFTER_SECONDS) {
@@ -1562,12 +1779,26 @@ var PEERS_QUERY = `
 * network-accessible. All requests are auth-gated via signature
 * verification so unauthenticated callers are rejected.
 */
-function syncProtocolRoutes(getStore) {
+function syncProtocolRoutes(getStore, opts = {}) {
 	const app = new Hono();
+	const routeRateLimit = opts.routeRateLimit ?? null;
+	function rateLimitedResponse(c, key, authenticated) {
+		if (!routeRateLimit) return null;
+		const isRead = c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "OPTIONS";
+		const result = routeRateLimit.limiter.check(`${c.req.method}:${authenticated ? "auth" : "anon"}:${key}`, authenticated ? isRead ? routeRateLimit.readLimit : routeRateLimit.mutationLimit : isRead ? routeRateLimit.unauthenticatedReadLimit : routeRateLimit.unauthenticatedMutationLimit);
+		if (result.allowed) return null;
+		c.header("Retry-After", String(result.retryAfterS));
+		return c.json({
+			error: "rate_limited",
+			retry_after_s: result.retryAfterS
+		}, 429);
+	}
 	app.get("/v1/status", (c) => {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		const limited = rateLimitedResponse(c, auth.deviceId, true);
+		if (limited) return limited;
 		try {
 			let device = store.db.prepare("SELECT device_id, fingerprint FROM sync_device LIMIT 1").get();
 			if (!device) {
@@ -1591,7 +1822,9 @@ function syncProtocolRoutes(getStore) {
 	app.get("/v1/ops", (c) => {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		const limited = rateLimitedResponse(c, auth.deviceId, true);
+		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
 		try {
 			const since = c.req.query("since") ?? null;
@@ -1637,7 +1870,9 @@ function syncProtocolRoutes(getStore) {
 	app.get("/v1/snapshot", (c) => {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		const limited = rateLimitedResponse(c, auth.deviceId, true);
+		if (limited) return limited;
 		try {
 			const rawGeneration = c.req.query("generation");
 			const generation = rawGeneration != null && rawGeneration.trim().length > 0 ? Number.parseInt(rawGeneration, 10) : null;
@@ -1673,10 +1908,12 @@ function syncProtocolRoutes(getStore) {
 	});
 	app.post("/v1/ops", async (c) => {
 		const store = getStore();
-		const raw = Buffer.from(await c.req.arrayBuffer());
-		if (raw.length > MAX_SYNC_BODY_BYTES) return c.json({ error: "payload_too_large" }, 413);
+		const raw = await readBoundedRequestBytes(c.req.raw, MAX_SYNC_BODY_BYTES);
+		if (raw == null) return c.json({ error: "payload_too_large" }, 413);
 		const auth = authorizeSyncRequest(store, c.req, raw);
-		if (!auth.ok) return c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		const limited = rateLimitedResponse(c, auth.deviceId, true);
+		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
 		let body;
 		try {
@@ -1793,7 +2030,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				statusPayload.daemon_detail = runtimeStatus.detail ?? daemonDetail;
 			}
 			const peersItems = store.db.prepare(PEERS_QUERY).all().map((row) => {
-				const peer = mapPeerRow(row, showDiag);
+				const peer = mapPeerRow(store, row, showDiag);
 				peer.status = peerStatus(peer);
 				return peer;
 			});
@@ -1824,7 +2061,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const sharingReview = store.sharingReviewSummary(project);
 			const coordinator = redactCoordinatorStatus(await coordinatorStatusSnapshot(store, config), showDiag);
 			let joinRequests = [];
-			if (includeJoinRequests && config.syncCoordinatorAdminSecret) try {
+			if (includeJoinRequests && showDiag && config.syncCoordinatorAdminSecret) try {
 				joinRequests = await listCoordinatorJoinRequests(config);
 			} catch {
 				joinRequests = [];
@@ -1859,7 +2096,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				sharing_review: sharingReview,
 				coordinator
 			};
-			if (includeJoinRequests) responsePayload.join_requests = joinRequests;
+			if (includeJoinRequests && showDiag) responsePayload.join_requests = joinRequests;
 			return c.json(responsePayload);
 		}
 	});
@@ -1867,7 +2104,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		const store = getStore();
 		{
 			const showDiag = queryBool(c.req.query("includeDiagnostics"));
-			const peers = store.db.prepare(PEERS_QUERY).all().map((row) => mapPeerRow(row, showDiag));
+			const peers = store.db.prepare(PEERS_QUERY).all().map((row) => mapPeerRow(store, row, showDiag));
 			return c.json({
 				items: peers,
 				redacted: !showDiag
@@ -1877,6 +2114,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 	app.get("/api/sync/actors", (c) => {
 		const store = getStore();
 		{
+			ensureLocalActorRecord(store);
 			const d = drizzle(store.db, { schema });
 			const includeMerged = queryBool(c.req.query("includeMerged"));
 			const query = d.select().from(schema.actors);
@@ -1955,6 +2193,216 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			return c.json({ ok: true });
 		}
 	});
+	app.post("/api/sync/run", async (c) => {
+		const store = getStore();
+		let body = {};
+		try {
+			body = await c.req.json();
+		} catch {
+			body = {};
+		}
+		if (!readCoordinatorSyncConfig().syncEnabled) return c.json({ error: "sync_disabled" }, 403);
+		const address = typeof body.address === "string" && body.address.trim() ? body.address.trim() : null;
+		const requestedPeerId = typeof body.peer_device_id === "string" && body.peer_device_id.trim() ? body.peer_device_id.trim() : null;
+		let peerIds;
+		if (address) {
+			const peerId = findPeerDeviceIdForAddress(store, address);
+			if (!peerId) return c.json({ error: "unknown peer address" }, 404);
+			peerIds = [peerId];
+		} else if (requestedPeerId) peerIds = store.db.prepare("SELECT peer_device_id FROM sync_peers WHERE peer_device_id = ?").all(requestedPeerId).map((row) => String(row.peer_device_id ?? "").trim()).filter(Boolean);
+		else peerIds = store.db.prepare("SELECT peer_device_id FROM sync_peers").all().map((row) => String(row.peer_device_id ?? "").trim()).filter(Boolean);
+		const items = [];
+		for (const peerId of peerIds) {
+			const result = await runSyncPass(store.db, peerId);
+			items.push({
+				peer_device_id: peerId,
+				...result
+			});
+		}
+		return c.json({ items });
+	});
+	app.post("/api/sync/peers/scope", async (c) => {
+		const store = getStore();
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid json" }, 400);
+		}
+		const peerDeviceId = String(body.peer_device_id ?? "").trim();
+		if (!peerDeviceId) return c.json({ error: "peer_device_id required" }, 400);
+		const include = Array.isArray(body.include) ? body.include.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean) : null;
+		const exclude = Array.isArray(body.exclude) ? body.exclude.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean) : null;
+		const inheritGlobal = Boolean(body.inherit_global);
+		const d = drizzle(store.db, { schema });
+		if (!d.select({ peer_device_id: schema.syncPeers.peer_device_id }).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).get()) return c.json({ error: "peer not found" }, 404);
+		d.update(schema.syncPeers).set({
+			projects_include_json: inheritGlobal ? null : JSON.stringify(include ?? []),
+			projects_exclude_json: inheritGlobal ? null : JSON.stringify(exclude ?? [])
+		}).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).run();
+		const row = d.select({
+			projects_include_json: schema.syncPeers.projects_include_json,
+			projects_exclude_json: schema.syncPeers.projects_exclude_json
+		}).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).get();
+		if (!row) return c.json({ error: "peer not found" }, 404);
+		return c.json({
+			ok: true,
+			project_scope: currentProjectScope(row, readPeerProjectFilters(store, peerDeviceId))
+		});
+	});
+	app.post("/api/sync/peers/identity", async (c) => {
+		const store = getStore();
+		ensureLocalActorRecord(store);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid json" }, 400);
+		}
+		const peerDeviceId = String(body.peer_device_id ?? "").trim();
+		if (!peerDeviceId) return c.json({ error: "peer_device_id required" }, 400);
+		const requestedActorId = body.actor_id == null ? void 0 : String(body.actor_id ?? "").trim() || null;
+		const claimedLocalActor = typeof body.claimed_local_actor === "boolean" ? body.claimed_local_actor : void 0;
+		const d = drizzle(store.db, { schema });
+		const peer = d.select({
+			peer_device_id: schema.syncPeers.peer_device_id,
+			actor_id: schema.syncPeers.actor_id,
+			claimed_local_actor: schema.syncPeers.claimed_local_actor
+		}).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).get();
+		if (!peer) return c.json({ error: "peer not found" }, 404);
+		let nextActorId = peer.actor_id ?? null;
+		let nextClaimedLocalActor = Boolean(peer.claimed_local_actor);
+		if (requestedActorId !== void 0) {
+			nextActorId = requestedActorId;
+			if (requestedActorId) {
+				const actor = d.select({
+					actor_id: schema.actors.actor_id,
+					is_local: schema.actors.is_local,
+					status: schema.actors.status
+				}).from(schema.actors).where(eq(schema.actors.actor_id, requestedActorId)).get();
+				if (!actor) return c.json({ error: "actor not found" }, 404);
+				if (actor.status !== "active") return c.json({ error: "actor not active" }, 409);
+				nextClaimedLocalActor = claimedLocalActor ?? Boolean(actor.is_local);
+			} else nextClaimedLocalActor = claimedLocalActor ?? false;
+		} else if (claimedLocalActor !== void 0) {
+			nextClaimedLocalActor = claimedLocalActor;
+			if (claimedLocalActor) nextActorId = store.actorId;
+			else if (nextActorId === store.actorId) nextActorId = null;
+		}
+		d.update(schema.syncPeers).set({
+			actor_id: nextActorId,
+			claimed_local_actor: nextClaimedLocalActor ? 1 : 0
+		}).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).run();
+		return c.json({
+			ok: true,
+			actor_id: nextActorId,
+			claimed_local_actor: nextClaimedLocalActor
+		});
+	});
+	app.post("/api/sync/actors", async (c) => {
+		const store = getStore();
+		ensureLocalActorRecord(store);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid json" }, 400);
+		}
+		const displayName = String(body.display_name ?? "").trim();
+		if (!displayName) return c.json({ error: "display_name required" }, 400);
+		const d = drizzle(store.db, { schema });
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const actor = {
+			actor_id: randomUUID(),
+			display_name: displayName,
+			is_local: 0,
+			status: "active",
+			merged_into_actor_id: null,
+			created_at: now,
+			updated_at: now
+		};
+		d.insert(schema.actors).values(actor).run();
+		return c.json(actor);
+	});
+	app.post("/api/sync/actors/rename", async (c) => {
+		const store = getStore();
+		ensureLocalActorRecord(store);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid json" }, 400);
+		}
+		const actorId = String(body.actor_id ?? "").trim();
+		const displayName = String(body.display_name ?? "").trim();
+		if (!actorId) return c.json({ error: "actor_id required" }, 400);
+		if (!displayName) return c.json({ error: "display_name required" }, 400);
+		const d = drizzle(store.db, { schema });
+		const actor = d.select().from(schema.actors).where(eq(schema.actors.actor_id, actorId)).get();
+		if (!actor) return c.json({ error: "actor not found" }, 404);
+		const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		d.update(schema.actors).set({
+			display_name: displayName,
+			updated_at: updatedAt
+		}).where(eq(schema.actors.actor_id, actorId)).run();
+		return c.json({
+			...actor,
+			display_name: displayName,
+			updated_at: updatedAt
+		});
+	});
+	app.post("/api/sync/actors/merge", async (c) => {
+		const store = getStore();
+		ensureLocalActorRecord(store);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid json" }, 400);
+		}
+		const primaryActorId = String(body.primary_actor_id ?? "").trim();
+		const secondaryActorId = String(body.secondary_actor_id ?? "").trim();
+		if (!primaryActorId) return c.json({ error: "primary_actor_id required" }, 400);
+		if (!secondaryActorId) return c.json({ error: "secondary_actor_id required" }, 400);
+		if (primaryActorId === secondaryActorId) return c.json({ error: "actor ids must differ" }, 400);
+		const d = drizzle(store.db, { schema });
+		const primary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, primaryActorId)).get();
+		const secondary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, secondaryActorId)).get();
+		if (!primary || !secondary) return c.json({ error: "actor not found" }, 404);
+		if (primary.status !== "active") return c.json({ error: "primary actor not active" }, 409);
+		if (secondary.status !== "active") return c.json({ error: "secondary actor not active" }, 409);
+		if (secondary.is_local) return c.json({ error: "cannot merge local actor" }, 409);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const mergedCount = store.db.transaction(() => {
+			const peerUpdate = d.update(schema.syncPeers).set({ actor_id: primaryActorId }).where(eq(schema.syncPeers.actor_id, secondaryActorId)).run();
+			if (primary.is_local) d.update(schema.syncPeers).set({ claimed_local_actor: 1 }).where(eq(schema.syncPeers.actor_id, primaryActorId)).run();
+			d.update(schema.actors).set({
+				status: "merged",
+				merged_into_actor_id: primaryActorId,
+				updated_at: now
+			}).where(eq(schema.actors.actor_id, secondaryActorId)).run();
+			return Number(peerUpdate.changes ?? 0);
+		})();
+		return c.json({ merged_count: mergedCount });
+	});
+	app.post("/api/sync/legacy-devices/claim", async (c) => {
+		const store = getStore();
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid json" }, 400);
+		}
+		const originDeviceId = String(body.origin_device_id ?? "").trim();
+		if (!originDeviceId) return c.json({ error: "origin_device_id required" }, 400);
+		const updated = claimLegacyDeviceAsSelf(store, originDeviceId);
+		if (updated <= 0) return c.json({ error: "legacy device not found" }, 404);
+		return c.json({
+			ok: true,
+			origin_device_id: originDeviceId,
+			updated
+		});
+	});
 	app.post("/api/sync/peers/accept-discovered", async (c) => {
 		const store = getStore();
 		let body;
@@ -2132,7 +2580,9 @@ function createApp(opts) {
 		root: staticRoot,
 		rewriteRequestPath: (path) => path.replace(/^\/assets/, "")
 	}));
-	const indexHtml = readFileSync(join(staticRoot, "index.html"), "utf-8");
+	const indexPath = join(staticRoot, "index.html");
+	if (!existsSync(indexPath)) throw new Error(`Viewer assets missing at ${indexPath}. Run \`pnpm build\` from the repo root before starting the viewer.`);
+	const indexHtml = readFileSync(indexPath, "utf-8");
 	app.get("*", (c) => {
 		if (c.req.path.startsWith("/api/")) return c.json({ error: "not found" }, 404);
 		return c.html(indexHtml);
@@ -2151,8 +2601,18 @@ function createApp(opts) {
 */
 function createSyncApp(opts) {
 	const storeFactory = opts?.storeFactory ?? getStore;
+	const requestRateLimit = opts?.syncRequestRateLimit ?? {};
+	const rateLimiter = requestRateLimit.limiter ?? createInMemoryRequestRateLimiter();
+	const readLimit = Math.max(1, Math.trunc(requestRateLimit.readLimit ?? 120));
+	const mutationLimit = Math.max(1, Math.trunc(requestRateLimit.mutationLimit ?? 30));
 	const app = new Hono();
-	app.route("/", syncProtocolRoutes(storeFactory));
+	app.route("/", syncProtocolRoutes(storeFactory, { routeRateLimit: {
+		limiter: rateLimiter,
+		readLimit,
+		mutationLimit,
+		unauthenticatedReadLimit: Math.max(1, Math.trunc(requestRateLimit.unauthenticatedReadLimit ?? Math.min(20, readLimit))),
+		unauthenticatedMutationLimit: Math.max(1, Math.trunc(requestRateLimit.unauthenticatedMutationLimit ?? Math.min(10, mutationLimit)))
+	} }));
 	app.all("*", (c) => c.json({ error: "not found" }, 404));
 	return app;
 }